Risk Appetite – Taking the Right Amounts of the Right RisksACSDA Senior Summit – December 5, 2013
2
Agenda
1. Introduction and Risk Appetite Overview
(20 minutes)2. CDS Case Study (60 minutes)3. Discussion Groups (45 minutes)4. Presentation of Discussion Group
Results (45 minutes)
Please ask questions or provide comments at any time and share your experiences!
3
Defining Risk Capacity and Risk Appetite• Risk capacity “refers to the maximum potential
impact of a risk event that the firm could withstand and remain a going concern”(1).
• Risk appetite “expresses the total amount of risk that an organization is willing to take to achieve its strategic objectives and meet its obligations to its stakeholders”(2)
(1) Committee of Sponsoring Organizations of the Treadway Commission (COSO), Strengthening Enterprise Risk Management for Strategic Advantage, 2009
(2) Towers Watson, Risk Appetite –The Foundation of Enterprise Risk Management, 2010
Capacity ≥ Appetite
Overview
4
Need for a Risk Appetite Statement• Not having a risk appetite statement can:
– lead to inadequate control resulting in the acceptance of undesirable risk positions, or
– an avoidance of acceptable risks and underperformance
• “All the cool kids are doing it”– Organizations that we consider our peers in risk
management have developed or are developing risk appetite statements
• Lastly, the regulators require it!– The CPSS/IOSCO Principles for Financial Market
Infrastructures (PFMIs) explicitly require FMIs to have a “risk tolerance” statement
Overview
5
CDS Case Study
Objective: To share the experience that CDS has had in order to (a) provide useful guidance to CSDs beginning a similar exercise (b) provoke discussion of experiences of other CSDs (c) to inform CDS’s next phase of enhancements
CDS’s experience in developing and using risk appetite has had 3 distinct phases:• Phase 1 (2007 to 2010)• Phase 2 (2010 to 2013)• Phase 3 (2013+)
CDS Case Study
6
Phase 1 – A Starting Point
Defined “risk tolerance” only for the purposes of identifying our most important risks
A key enterprise risk is an event which, if it occurred, could plausibly create an outcome exceeding CDS’s risk tolerance, more specifically:
– A financial loss to CDS in excess of its reserves, currently $10 million;
– A financial loss to participants who are members of a collateralized credit ring in CDSX or cross-border services in excess of realized value of the collateral available in the relevant collateral pools;
– An inability of CDS to meet fundamental services requirements;
– An inability of CDS to meet its financial obligations as contractually obligated;
– A reputational loss to CDS such that its ability to effectively provide services to its participants and customers is seriously questioned.
CDS Case Study
7
In 2007, CDS had not expressed its willingness to take risk in any meaningful way
Key Enterprise Risks
Impa
ct
“Phantom Risks”H
igh
Low
LikelihoodLow High
Risks managed by existing processes
Enterprise Risk Tolerance
December 2007
“Risk tolerance” used as threshold for identifying risks that require attention by senior management and Board
Missed opportunity to use expression of willingness to take risks as part of day-to-day management of risks
In 2007, we thought that if these risks really existed, we would likely have been put out of business by then
CDS Case Study
8
Risk metrics without context
CDS presented these charts as part of a presentation on responding to market turmoil at the 2008 ACSDA general assembly in Toronto
Are these results good or bad? What can we measure them against in order to determine if they
are acceptable?
CDS Case Study
9
Zero Risk
Phase 2 – The light starts to go on!• We realized that our “risk tolerance” was not
our willingness to take risk, but our maximum capacity to take risk
• We needed to distinguish the risk appetite and capacity of our participants from that of CDS
• Most importantly, we needed to address critical cultural issues:– Need to eliminate “zero risk tolerance” mindset– Need to drive ownership and accountability for
risk management to the business units
CDS Case Study
10
Relative “Size” of Proprietary and Participant Risk Capacity and Appetite
Risk Capacity
Risk Appetite
CDS "Proprietary" Risks CDS "Participant" Risks
Risk Tolerance
The “Eye Chart” was presented to CDS’s Risk Management Committee in December 2010
CDS Case Study
11
Development of CDS’s risk appetite statement – 4 key inputs
Risk Appetit
e
Governing objective representing the value proposition of CDS to its key stakeholders
Risk capacity and constraints representing
CDS’s ability to bear risk
Risk philosophy representing CDS’s set of shared beliefs and attitudes on risk taking
Business strategy and objectives which embody
the strategic direction of CDS over the planned time
horizon
CDS Case Study
12
Phase 2 - Risk Appetite Development Cycle
Draft initial statements
Improve with input from senior
management
Improve with input from all stakeholders
Board review and approval
Governing objective, risk capacity and constraints, risk philosophy, business strategy and objectives
Keep senior management in the loop as statement changes with stakeholder input!
Stakeholders: participants,
regulators, Board members (should have
included staff!)
CDS Case Study
Risk appetite considerations
• Risk appetite is still an evolving concept and CDS’s risk appetite statement will evolve as we better understand our willingness to accept risk and as the environment and our strategy changes
• A risk appetite is not an excuse for poor performance, unexpected losses or lack of commitment to operational excellence
• Expressing a risk appetite does not mean that we don’t care about losses within our risk appetite…we will investigate and learn from losses…could it have been worse?…do we need to adjust our behavour in light of the loss?
13
CDS Case Study
Risk philosophyWith the senior management team, we identified a number of basic beliefs and expressions about how we think about risk:• CDS Clearing is fundamentally a risk averse organization. • CDS Clearing recognizes that its ability to manage risk can
ultimately affect the financial welfare of Canadians.• CDS Clearing has a fiduciary responsibility as a result of
holding assets in safekeeping for our participants.• CDS Clearing considers its peers in risk management to
include large financial institutions, public institutions vital to the health and welfare of Canadians and enterprises whose products require extreme levels of safety and reliability.
• CDS Clearing is too important to fail (without the moral hazard implications).
• CDS INC and CDS Innovations are able to take more risk than CDS Clearing.
14
CDS Case Study
Risk outcome rating exercise conducted with Board
Conducted workshops with the Risk Management and Audit Committee of Board:• Discuss a number of risk exposures faced by
CDS;• Identify the relevant risk capacity for that type of
exposure;• Identify and quantify actual or potential
scenarios that have caused or could cause losses due to this type of risk exposure;
• Rate CDS’s appetite for the risk that could cause this outcome or scenario on an appropriate scale.
15
CDS Case Study
Board Workshop Exercise #1CDS holds cash owned by its participants and customers and invests that cash to generate a return. These investments can fluctuate in value as a result of changes in prices (market risk). The total value of these investments typically range between $50 million and $100 million. What is an acceptable level of risk for these investments?
Risk capacity = $10 million reserve
-10 0
Invest entire portfolio ABCP
in 2007
-50 to -100
Loss or Exposure ($ millions)
10% decline in value
-5 to -10
Gov't <1 year
"almost"zero
16
CDS Case Study
Board Workshop Exercise #2In order to record securities in CDSX, critical information about the characteristics of each security such as conversion and extension privileges must be extracted from various documents and entered into the system. Interpreting and recording this information is subject to error (operational risk). What is an acceptable level of risk?
Risk capacity = reserves +
insurance
-20 0
NBCN/Prov of Sask bond claim
-8
Loss or Exposure ($ millions)
-1.0
Max single claim under proposed limit of liability
-0.25
Max annual total claims under
proposed limit of liability
Observed historical loss
17
CDS Case Study
Board Workshop Exercise #3
The daily operation of CDSX is vital. As an IT system, CDSX’s availability can be affected by hardware, software and network failures. The recovery time objective (RTO) for CDSX is 2 hours after declaration of disruption. How much risk of a CDSX outage is acceptable?
Risk capacity = latest time to complete
pymt exchange
7 am
Disruption of primary and
secondary data centres
Days?
Time of CDSX recovery
CDSX recovery after 4 pm disruption
CDSX online up
7 pm
Failure of recovery to
secondary data centre
6 pm 4 pm
PX
18
CDS Case Study
19
Phase 2 – Where did we end up?
CDS Case Study
Quantitative and qualitative statements of our willingness to take specific kinds
of risksDifferent legal entities
are willing to take different amounts of
risk
Examples of these statements are provided in the appendix
20
Example 1 – Using risk appetite to manage risk exposure
October 2008 November 2013
Relevant Risk Appetite Statement: Participants are willing to accept losses which result from a defaulter’s collateral in a central counterparty service being insufficient. Participants expect that these uncollateralized losses should occur in no more than 1% of potential defaults for CNS.
CDS Case Study
21
Example 2 – Using risk appetite to manage risk exposure
October 2008 November 2013
Relevant Risk Appetite Statement: Participants are willing to accept losses resulting from the default of a fellow member of a category credit ring up to the amount of the collateral pledged to the collateral pool by the surviving members (red line in graph).
CDS Case Study
22
Phase 3 – Risk appetite becomes fundamental part of decision making for everyone at CDSToday, there are still a number of issues that CDS needs to address:• The use of risk appetite as a key input into risk decisions is
not consistent • Many parts of the organization are unfamiliar with relevant
risk appetite statements• Operational risk appetite statement has not successfully
been translated to day-to-day operations• Lingering cultural issues – perception of zero risk tolerance
still exists; often viewed as an excuse for not taking risk• Our ownership structure has fundamentally changed and we
need to generate return for our shareholders while appropriately balancing that return with the resulting risks given our systemic importance
CDS Case Study
23
Phase 3 - Risk appetite in the context of a comprehensive approach to managing our business
Organizational Objectives
RCSA – Risk Assessment
Control Objectives
Control Design
Process RCSA
Control Procedures Inte
rnal
Aud
it Re
view
Business Strategy
Compliance Rules
Risk Appetite
Mngt Supervision
Escalation
Self-Assessment
Create coaching
opportunities
CDS Case Study
24
Conclusions and lessons from CDS’s experience (so far)
• Defining and using your risk appetite statement is a journey, it should and will evolve
• Keep things simple• Use real examples from your business• Involve all stakeholders• Tailor it for your organization, make it your
own
CDS Case Study
25
Discussion GroupsEach group is assigned a topic for discussion and will report back on the results:• Group 1 – What corporate cultural issues can you foresee (or have
experienced) in developing and implementing risk appetite and how can these be addressed?
• Group 2 – Operational risk is an important category of risk for CSDs and presents particular challenges for defining and implementing risk appetite statements. What are those challenges and how can they be addressed?
• Group 3 – CSDs operate with different ownership structures while providing systemically important services in their markets. How can risk appetite help balance meeting the needs of owners (e.g. return) and market participants (e.g. low cost and safety)?
• Group 4 – A risk appetite statement typically includes a series of quantitative and qualitative measures. What are the characteristics of effective measures for risk appetite statements?
If your group prefers to address a new topic, please go ahead! Select a spokesperson for your group and report on the results of your discussion.
Discussion Groups
26
Appendix: Other examples of risk appetite statements
Operational Risk• Are willing to accept cumulative losses (to CDS itself or to
its participants caused by CDS) resulting from known and accepted operational risk exposures up to 0.5% of total expenses during any 12-month period (approx. $350,000).
• Are willing to accept losses from operational processes where the cost of mitigating the risk is greater than a reasonable estimate of the potential future loss (subject to limit above).
Strategic Risk• Are willing to invest up to $10 million each year in
enhancements to existing businesses with an expected positive return in terms of reduced cost, improved efficiency or value for participants.
27
Appendix: Other examples of risk appetite statements
Financial Risk• Are willing to accept only extremely low amounts of
market, credit and liquidity risks for investments made on behalf of third parties:– Market risk: Maximum one-day portfolio market value decline
resulting from interest rate changes of less than 0.2% with 99% confidence ;
– Market risk: Zero foreign exchange risk;– Credit risk: Extremely low issuer default risk (federal and
provincial government securities only);– Liquidity risk: Lowest possible risk of being unable to
immediately liquidate positions without loss.
28
